Cosenary Instagram-PHP-API contains reflected XSS vulnerability

보통 6.1CVE-2019-14470 · GHSA-gcv6-2v9c-rj48 · Published 04/09/2019 · updated 17/06/2026

요약

CVE-2019-14470은(는) cosenary/instagram, user pro (userproplugin)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 83.0%, 전체 취약점의 99.7%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
cosenary/instagram Packagist	`≤ 2.3`	No fix yet
user pro userproplugin	`≤ 4.9.32`	No fix yet

Description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), used in the UserPro plugin through 4.9.32 for WordPress, is vulnerable to cross-site scripting via the example/success.php error_description parameter.

Vulnerable code:

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

Proof-of-Concept:

https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

NVD description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.

References

nvd.nist.gov/vuln/detail/CVE-2019-14470 · ADVISORY
cosenary/Instagram-PHP-API · PACKAGE
cosenary/Instagram-PHP-API · WEB
wpvulndb.com/vulnerabilities/9815 · WEB
exploit-db.com/exploits/47304 · WEB
packetstormsecurity.com/files/154206/WordPress-UserPro-4.9.32-Cross-Site-Scripting.html · WEB
cosenary/Instagram-PHP-API · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2019-14470은(는) cosenary/instagram, user pro (userproplugin)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 83.0%, 전체 취약점의 99.7%보다 높음.

아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package

Affected versions

Patched versions

cosenary/instagram

Packagist

≤ 2.3

No fix yet

user pro

userproplugin

≤ 4.9.32

No fix yet

Description

Vulnerable code:

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

Proof-of-Concept:

https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

NVD description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.